github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
13,580 Commits 2 Branches 347 Tags
d00aaf3ff315a507ca6b88b76abd04187eacf501
Commit Graph

13580 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jose Diaz-Gonzalez
d00aaf3ff3 Merge pull request #8586 from dokku/assert-output-contains 
Count assert_output_contains matches as fixed strings
 2026-05-09 16:00:27 -04:00
Jose Diaz-Gonzalez
e78d3bcc78 Merge pull request #8591 from dokku/arbitrary-file-write 
Harden archive extraction against symlink traversal
 2026-05-09 15:58:31 -04:00
Jose Diaz-Gonzalez
33dd8005dd Merge pull request #8589 from dokku/netrc-permissions 2026-05-09 15:36:10 -04:00
Jose Diaz-Gonzalez
90aa64e7e3 Merge pull request #8588 from dokku/sanitize-openresty-filenames 2026-05-09 15:36:01 -04:00
Jose Diaz-Gonzalez
f4213a4bf5 tests: prevent assert_output_contains from aborting on no match 
Bats runs tests under `set -eo pipefail`, so when `grep -F -o` finds nothing inside the count pipe it exits 1, the whole pipe fails, errexit fires, and the function aborts before reaching the count comparison. Wrap grep in `{ ... || true; }` so the pipe stays zero when the pattern is absent and the helper falls through to the flunk message.
 2026-05-09 13:36:29 -04:00
Jose Diaz-Gonzalez
253d47ecf5 Merge pull request #8592 from dokku/security-section 
Add security section to release changelog
 2026-05-09 13:27:34 -04:00
Jose Diaz-Gonzalez
0b93488006 feat: add security section to release changelog 2026-05-09 13:19:33 -04:00
Jose Diaz-Gonzalez
9decf16ea1 feat: configure archive limits via git properties 
Replaces the `DOKKU_ARCHIVE_MAX_SIZE` and `DOKKU_ARCHIVE_MAX_FILES` environment variables with global git properties (`archive-max-size` and `archive-max-files`), configurable via `dokku git:set --global` and surfaced through `dokku git:report --global`. Defaults remain `1073741824` bytes and `10000` entries.
 2026-05-09 13:08:23 -04:00
Jose Diaz-Gonzalez
2df0791fcd fix: prevent tar symlink traversal in archive extraction 
Archives passed to git:from-archive and certs:add were extracted without symlink or path validation, allowing a crafted archive to write arbitrary files anywhere writable by the dokku user via symlink traversal. Extraction now pre-scans entries for absolute paths, parent traversal, and unsafe symlinks, applies the GNU tar `--no-unsafe-links` flag when available, and validates symlinks after extraction.
 2026-05-09 12:54:42 -04:00
Jose Diaz-Gonzalez
6eb8b8632c fix: enforce 0600 permissions on .netrc credentials file 
The previous use of `touch` before `netrc set` allowed the file to inherit the umask and be world-readable, exposing stored git credentials to local users. The set and unset paths now explicitly chmod 0600 and chown to the dokku user, and the plugin install hook repairs permissions on already-affected installations.
 2026-05-09 12:22:17 -04:00
Jose Diaz-Gonzalez
a70728f61e fix: sanitize openresty include filenames to prevent eval injection 
Add defense-in-depth sanitization for OpenResty include files to prevent
OS command injection via malicious filenames that break shell quoting in eval.

- Add filename validation in core-post-extract using regex [^a-zA-Z0-9_.-]
- Validate both http-includes and location-includes paths
- Abort deploy via dokku_log_fail on unsafe filenames
- Skip non-regular files (symlinks, directories) during extraction
- Add security regression test with unsafe filename containing space
- Keep existing guards in docker-args-process-deploy as belt-and-suspenders
- Update documentation to clarify allowed filename characters

Addresses CVSS 9.9 vulnerability where filenames like poc'$(cmd)'x.conf
could escape shell quoting and execute arbitrary commands during deploy.
 2026-05-09 12:20:50 -04:00
Jose Diaz-Gonzalez
25abd38387 tests: use /bin/bash -c to execute commands in init tests 2026-05-09 10:48:29 -04:00
Jose Diaz-Gonzalez
2974830e8f Merge pull request #8587 from vixalien/patch-1 
Correct buildkit builder code block syntax
 2026-05-09 10:45:42 -04:00
Angelo Verlain
2c3f29daca fox: correct buildkit builder code block syntax 2026-05-09 04:07:01 +02:00
Jose Diaz-Gonzalez
38de83eabf tests: use inverted assert 
Also echo the status
 2026-05-08 21:39:57 -04:00
Jose Diaz-Gonzalez
01268ebad9 tests: fix count 2026-05-08 21:38:22 -04:00
Jose Diaz-Gonzalez
2cf2846c6b test: count assert_output_contains matches as fixed strings 
Replace the bash pattern-substitution loop with grep -F -o piped to wc -l so the helper counts literal substring occurrences instead of treating the expected value as a glob pattern. The old implementation interpreted `[`, `]`, `*`, `?`, and `\` as pattern syntax, which made `assert_output_contains "['task.py', 'test']"` report 17 matches against an output that contained the string exactly once - the inner characters were being matched as a character class. assert_output_not_contains delegates to assert_output_contains and is fixed transitively.
 2026-05-08 18:56:33 -04:00
Jose Diaz-Gonzalez
47c8141148 Merge pull request #8578 from dokku/8566-core-post-extract-in-four-builder-plugins-fails-under-bash-5-3 
Reference SOURCECODE_WORK_DIR in builder core-post-extract
 2026-05-08 17:06:10 -04:00
Jose Diaz-Gonzalez
b8f94dfa7f Merge pull request #8581 from dokku/dependabot/docker/tests/apps/go-fail-predeploy/golang-1.26.3 
chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/go-fail-predeploy
 2026-05-08 17:00:05 -04:00
Jose Diaz-Gonzalez
4efe0eb9fd Merge pull request #8582 from dokku/dependabot/docker/tests/apps/gogrpc/golang-1.26.3 
chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/gogrpc
 2026-05-08 16:59:53 -04:00
Jose Diaz-Gonzalez
a6cfe3a2d1 Merge pull request #8584 from dokku/dependabot/docker/tests/apps/go-fail-postdeploy/golang-1.26.3 
chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/go-fail-postdeploy
 2026-05-08 16:31:33 -04:00
Jose Diaz-Gonzalez
390fe2b35a Merge pull request #8583 from dokku/dependabot/docker/tests/apps/zombies-dockerfile-tini/golang-1.26.3 
chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/zombies-dockerfile-tini
 2026-05-08 16:28:33 -04:00
Jose Diaz-Gonzalez
a5ee710496 Merge pull request #8585 from dokku/dependabot/docker/tests/apps/zombies-dockerfile-no-tini/golang-1.26.3 
chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/zombies-dockerfile-no-tini
 2026-05-08 16:28:25 -04:00
dependabot[bot]
1706729cfe chore(deps): bump golang in /tests/apps/zombies-dockerfile-no-tini 
Bumps golang from 1.26.2 to 1.26.3.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-08 13:53:22 +00:00
dependabot[bot]
51dc7799d0 chore(deps): bump golang in /tests/apps/go-fail-postdeploy 
Bumps golang from 1.26.2 to 1.26.3.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-08 13:53:11 +00:00
dependabot[bot]
07d301775e chore(deps): bump golang in /tests/apps/zombies-dockerfile-tini 
Bumps golang from 1.26.2 to 1.26.3.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-08 13:53:10 +00:00
dependabot[bot]
0619338607 chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/gogrpc 
Bumps golang from 1.26.2 to 1.26.3.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-08 13:53:04 +00:00
dependabot[bot]
902b7f6af4 chore(deps): bump golang in /tests/apps/go-fail-predeploy 
Bumps golang from 1.26.2 to 1.26.3.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-08 13:53:03 +00:00
Jose Diaz-Gonzalez
25f87164ce Merge pull request #8574 from dokku/dependabot/docker/tests/apps/dockerfile-noexpose/node-26-alpine 
chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-noexpose
 2026-05-08 01:35:18 -04:00
Jose Diaz-Gonzalez
67ce12b973 Merge pull request #8575 from dokku/dependabot/docker/tests/apps/dockerfile-procfile-bad/node-26-alpine 
chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-procfile-bad
 2026-05-08 01:35:10 -04:00
Jose Diaz-Gonzalez
5d212f3195 test: use BATS_TEST_TMPDIR in core-post-extract regression tests 
The previous form set `trap "rm -rf '$TMP_DIR'" RETURN` inside the test, but bats propagates `RETURN` traps to nested function calls, so the trap fired on the first `assert_success` and removed the work directory before the trigger script ran. Switching to bats's per-test `BATS_TEST_TMPDIR` removes the trap entirely and lets bats handle cleanup.
 2026-05-08 01:34:05 -04:00
Jose Diaz-Gonzalez
05ffccd7e7 Merge pull request #8577 from dokku/dependabot/docker/tests/apps/dockerfile-app-json-formations/node-26-alpine 
chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-app-json-formations
 2026-05-07 15:46:32 -04:00
Jose Diaz-Gonzalez
5dfda450d9 Merge pull request #8576 from dokku/dependabot/docker/tests/apps/dockerfile/node-26-alpine 
chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile
 2026-05-07 15:28:44 -04:00
Jose Diaz-Gonzalez
a7119ba693 Merge pull request #8573 from dokku/dependabot/docker/tests/apps/dockerfile-procfile/node-26-alpine 
chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-procfile
 2026-05-07 15:28:24 -04:00
Jose Diaz-Gonzalez
870b93c8e3 Merge pull request #8580 from othercorey/patch-1 
Set issue type in bug report template
 2026-05-07 15:28:07 -04:00
othercorey
48594ca0a4 Set issue type in bug report template 2026-05-07 14:18:30 -05:00
Jose Diaz-Gonzalez
5e279074fd Merge pull request #8579 from dokku/dokku-bot-dependency-patching 
Use type prefix for dokku-bot dependency label
 2026-05-07 14:41:44 -04:00
Jose Diaz-Gonzalez
5f0c5a5a4f chore: use type prefix for dokku-bot dependency label 2026-05-07 14:39:06 -04:00
Dokku Bot
983c462904 Release 0.38.1 
# History

## 0.38.1

Install/update via the bootstrap script:

```shell
wget -NP . https://dokku.com/install/v0.38.1/bootstrap.sh
sudo DOKKU_TAG=v0.38.1 bash bootstrap.sh
```

### Bug Fixes

- #8563: @josegonzalez Source property-functions where fn-plugin-property-* helpers are used
- #8559: @josegonzalez Install cnb pack from github releases instead of ppa
- #8558: @josegonzalez Chown migrated legacy storage entries to dokku
- #8545: @josegonzalez Deflake haproxy bats tests

### Refactors

- #8546: @josegonzalez Consolidate nginx.conf.sigil server blocks

### Documentation

- #8548: @josegonzalez Use explicit type property in proxy:set examples
- #8547: @josegonzalez Document plugin properties migrated from env vars
- #8544: @josegonzalez Fix reference to when the build plugin was introduced

### Tests

- #8565: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 in /tests/apps/gogrpc
- #8568: @dependabot[bot] chore(deps): bump gunicorn from 25.3.0 to 26.0.0 in /tests/apps/multi
- #8572: @dependabot[bot] chore(deps): bump django from 5.2.13 to 5.2.14 in /tests/apps/dockerfile-release
- #8570: @dependabot[bot] chore(deps): bump gunicorn from 25.3.0 to 26.0.0 in /tests/apps/dockerfile-release
- #8567: @dependabot[bot] chore(deps): bump gunicorn from 25.3.0 to 26.0.0 in /tests/apps/python-flask

### Dependencies

- #8571: @dependabot[bot] chore(deps): bump traefik from v3.6.15 to v3.7.0 in /plugins/traefik-vhosts
- #8569: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.44 to 2.11.45 in /plugins/scheduler-k3s
- #8561: @dokku-bot chore: bump pack to 0.40.4
- #8555: @dependabot[bot] chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22 in /plugins/app-json
- #8556: @dependabot[bot] chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 in /plugins/scheduler-k3s
- #8550: @dokku-bot chore: bump docker-container-healthchecker to 0.15.2
- #8553: @dokku-bot chore: bump dokku-event-listener to 0.19.1
- #8552: @dokku-bot chore: bump lambda-builder to 0.9.3
- #8551: @dokku-bot chore: bump procfile-util to 0.20.7
- #8554: @dependabot[bot] chore(deps): bump peter-evans/create-pull-request from 7 to 8
v0.38.1 		2026-05-07 17:29:53 +00:00
Jose Diaz-Gonzalez
bc8adfa6e2 test: add run_plugn_trigger and run_plugin_script bats helpers 
Both helpers wrap `run /bin/bash -c "..."` with the env vars dokku plugin scripts and `plugn` need, replacing the long inline boilerplate that was duplicated across `tests/unit/resource_3.bats` and the new `core-post-extract` regression tests in the builder bats files.
 2026-05-07 12:47:00 -04:00
Jose Diaz-Gonzalez
eb17a383c6 fix: reference SOURCECODE_WORK_DIR in builder core-post-extract 
The builder-dockerfile, builder-lambda, builder-nixpacks, builder-pack and builder-railpack `core-post-extract` triggers assigned `$2` to a local `SOURCECODE_WORK_DIR` but called `pushd "$TMP_WORK_DIR"`, which was unset. Bash 5.2 silently accepted `pushd ""`, so the bug stayed dormant. Bash 5.3 (shipped with Ubuntu 26.04) makes it a hard error and `set -e` aborts the trigger, causing every `git push` to fail with `pushd: null directory`.
 2026-05-07 12:39:46 -04:00
Jose Diaz-Gonzalez
368a6999c9 Merge pull request #8565 from dokku/dependabot/go_modules/tests/apps/gogrpc/google.golang.org/grpc-1.81.0 
chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 in /tests/apps/gogrpc
 2026-05-07 10:37:25 -04:00
dependabot[bot]
1e7df47feb chore(deps): bump node in /tests/apps/dockerfile-app-json-formations 
Bumps node from 25-alpine to 26-alpine.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-07 13:55:48 +00:00
dependabot[bot]
39f15930a0 chore(deps): bump node in /tests/apps/dockerfile 
Bumps node from 25-alpine to 26-alpine.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-07 13:55:42 +00:00
dependabot[bot]
a8fd9122fe chore(deps): bump node in /tests/apps/dockerfile-procfile-bad 
Bumps node from 25-alpine to 26-alpine.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-07 13:55:38 +00:00
dependabot[bot]
09ee789849 chore(deps): bump node in /tests/apps/dockerfile-noexpose 
Bumps node from 25-alpine to 26-alpine.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-07 13:55:36 +00:00
dependabot[bot]
117a9b43f9 chore(deps): bump node in /tests/apps/dockerfile-procfile 
Bumps node from 25-alpine to 26-alpine.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-07 13:55:35 +00:00
Jose Diaz-Gonzalez
2d9521a855 Merge pull request #8568 from dokku/dependabot/pip/tests/apps/multi/gunicorn-26.0.0 2026-05-07 07:55:41 -04:00
Jose Diaz-Gonzalez
0429ecfd98 Merge pull request #8572 from dokku/dependabot/pip/tests/apps/dockerfile-release/django-5.2.14 
chore(deps): bump django from 5.2.13 to 5.2.14 in /tests/apps/dockerfile-release
 2026-05-07 07:09:01 -04:00
Jose Diaz-Gonzalez
c676a09bd5 Merge pull request #8571 from dokku/dependabot/docker/plugins/traefik-vhosts/traefik-v3.7.0 
chore(deps): bump traefik from v3.6.15 to v3.7.0 in /plugins/traefik-vhosts
 2026-05-07 07:08:53 -04:00